thorinas are ports 80/443 open and forwarded to Mailcow,? https://docs.mailcow.email/post_installation/firststeps-ssl/
In case port 80 is forwarded to NPM instead of Mailcow, Mailcow won’t be able to obtain Let’s Encrypt certificates, and you’ll need to copy the certs manually to your Mailcow server.
Also, if you forward port 443 to NPM, you’ll obviously need to proxy mail.yourdomain.tld:443 to Mailcow via NPM. However, port 443 is only used for HTTPS, i.e. the web UI, webmail and ActiveSync. For SMTP, IMAP, etc. to be able to use the properly signed certificates, they also need to be installed directly on the Mailcow server, so you still need to copy the over.
https://docs.mailcow.email/post_installation/firststeps-ssl/#additional-domain-names
https://docs.mailcow.email/post_installation/reverse-proxy/r_p/